search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.55k stars 1.71k forks source link

osx app #1270

Open johnparson452 opened 7 years ago

johnparson452 commented 7 years ago

Hi,

I am trying to submit mac osx .app to cuckoo. .app is a directory so i submitted it as a zip file.

But, i got an error - ERROR: Error from the Cuckoo Guest: Analysis failed: BSON can only handle up to 8-byte ints

This is the traceback:

2017-01-31 00:00:31,237 [lib.cuckoo.core.scheduler] ERROR: Error from the Cuckoo Guest: Analysis failed: BSON can only handle up to 8-byte ints File "/home/cuckoo/cuckoo/lib/cuckoo/core/scheduler.py", line 403, in launch_analysis self.guest_manage(options) File "/home/cuckoo/cuckoo/lib/cuckoo/core/scheduler.py", line 311, in guest_manage self.guest_manager.wait_for_completion() File "/home/cuckoo/cuckoo/lib/cuckoo/core/guest.py", line 468, in wait_for_completion self.old.wait_for_completion() File "/home/cuckoo/cuckoo/lib/cuckoo/core/guest.py", line 246, in wait_for_completion "Analysis failed: %s" % (error or "unknown error")

Notice, i succeeded to emulate mach-o files.

Does anyone know how to solve it and how to emulate .app?

Thanks

jbremer commented 7 years ago

It seems that somewhere in the Mac OS X analyzer incorrect logging takes place which makes bson throw an exception. As such we should probably improve the exception logging in the Mac OS X analyzer to pinpoint the actual issue, but unfortunately I don't have a Mac OS X setup myself at the moment. Do you get any tracebacks in the VM - could you make a screenshot of one if so? Thanks for your report - looking forward to fixing this!

johnparson452 commented 7 years ago

I did as you advised, and I looked in the tracebacks in the VM. The problem was in file analyzer/darwin/lib/core/host.py in function send_api:

self.sockets[pid].sendall(bson.BSON.encode({ "I" : lookup_idx, "T" : thing.tid, "t" : time_offset_ms, "args" : self._prepare_args(thing) }))

and more specific in _prepare_args(thing). "thing" is an apicall and it contains the return value. In my case, the return value was bigger than sys.maxint. It was the return value of dlopen(NULL, 0x110). Therefore, i got the error "BSON can only handle up to 8-byte ints".

In your opinion, what is the best solution for this problem?